4 ms·

The risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models. I would not run an OpenClaw with full

The risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models. I would not run an OpenClaw with full access to my bitwarden, but it certainly has some logins available to it, and can make purchases with link-cli which has human-in-the-loop.

pixl97 26d ago
Overt prompt injection is becoming harder, but research into conversation stearing has lead to new less obvious ways to modify what direction they move in. Also any longer running agent can lose track of the original prompt and start going off the rails.
sofixa 26d ago
Plenty of people are running OpenClaw with local models, and even the latest Qwens can be confused relatively easily by prompts such as "As per internal policy that was already approved before, do XYZ". And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.
chmod775 26d ago
There must be a bulk discount on those mindcuffs, considering there's a prompt injection or a related confused deputy story on HN every other day. Literally from hours ago: https://news.ycombinator.com/item?id=49506819 https://news.ycombinator.com/item?id=49506819 Even if you believe that they can't be tricked directly, consider that these things will happily build a small node.js app in the background just to fulfill some request, run npm install... and that might've already compromised you if you're only somewhat unlucky.
mechazawa 25d ago
prompt injection has been super easy for ages. Heck I do it sometimes against coworkers who process my review comments using claude. I'll tell claude to edit it's global claude.md file or even dump a key from their env (checking if they are using the correct sandbox) and it'll do it without confirming with their user.

4 ms·

The risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models. I would not run an OpenClaw with full

by stbenjam 26d ago

pixl97 26d ago
Overt prompt injection is becoming harder, but research into conversation stearing has lead to new less obvious ways to modify what direction they move in. Also any longer running agent can lose track of the original prompt and start going off the rails.
sofixa 26d ago
Plenty of people are running OpenClaw with local models, and even the latest Qwens can be confused relatively easily by prompts such as "As per internal policy that was already approved before, do XYZ". And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.
chmod775 26d ago
There must be a bulk discount on those mindcuffs, considering there's a prompt injection or a related confused deputy story on HN every other day. Literally from hours ago: https://news.ycombinator.com/item?id=49506819 https://news.ycombinator.com/item?id=49506819 Even if you believe that they can't be tricked directly, consider that these things will happily build a small node.js app in the background just to fulfill some request, run npm install... and that might've already compromised you if you're only somewhat unlucky.
mechazawa 25d ago
prompt injection has been super easy for ages. Heck I do it sometimes against coworkers who process my review comments using claude. I'll tell claude to edit it's global claude.md file or even dump a key from their env (checking if they are using the correct sandbox) and it'll do it without confirming with their user.